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AMENDMENTS TO THE SPECIFICATION 

Page 1. lines 7-13 

Hardware verification is currently the bottleneck and the most expensive task in 
the design of a semiconductor integrated circuit. Model checking is a method of formal 
verification that is gaining in popularity for this purpose. The method is described generally by 
Clarke et 1. in Model Checking (MIT Press, 1999) , which is incorporat e d h e r e in by r e f e r e nc e. 

Page 2, lines 1-11 

Model checking is preferably carried out automatically by a symbolic model 
checking program, such as SMV, as described, for example, by McMillan in Symbolic Model 
CAecAi/zg^ (Kluwer Academic PubHshers, 1993), which is incorporat e d h e r e in by r e f e r e nc e. A 
number of practical model checking tools are available, among them RuleBase, developed by 
EBM, which is described by Beer et al. in "RuleBase: an Industry-Oriented Form Verification 
Tool," in Proceedings of the Design Automation Conference DACV6 (Las Vegas, Nevada, 1996)^ 
which is incorporat e d h e r e in by r e f e r e nc e. 

Page 2. line 22 - Page 3, Line 9 

Coverage metrics have been applied in various fields of simulation-based 
verification in order to measure and improve the completeness with which a given simulation 
tool represents the actual behavior of a target system. An application of such a metric to model 
checking is described by Hoskote et al., in "Coverage Estimation for Symbolic Model 
Checking," in Proceedings of the Design Automation Conference DACV9 (IEEE Computer 
Society Press, 199) , which is incorporat e d her e in by r e f e r e nce . Th e authors pr e s e nt This 
publication presents a method for estimating whether a set of properties is sufficient to cover all 
possible states of a model. Th e y note It notes , however, that their the disclosed method cannot 
point out functionality that may be missing in the model, nor can it ensure that all possible paths 
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between the states are covered. Th e y indicat e The publication also indicates that "path coverage 
would be an ideal coverage metric because it can provide coverage of actual executions of the 
circuit over time." The authors consid e r publication considers that by comparison with state 
coverage, "path coverage is a much more intractable problem." 

Page 15. lines 3-13 

The above formulas correspond to the proeprties $0, $ 1, . . $8 listed 
symbolically below in Table II, which are a complete specification of arbiter 40 written in the 
form of a safety formula \l/ in Universal Computation Tree Logic (Icnown as ACTL). ACTL is a 
branching-time temporal logic. It is described in detail by Grumberg et al. in "Model Checking 
and Modular Verification," in ACM ransactions on Programming Language and Systems 16(3) 
(1994), pp. 843-871, which is incorporat e d h e r e in by r e fer e nc e. As the variable "robin" is not 
observable, it does not appear explicitly in the properties in Table 11. 

Page 2 Klines 20-28 

Preferably, for efficient computation, Sj, St, Ri, Rt, Li, Lt and SIMj are all 
represented as Ordered Binary Decision Diagrams (OBDDs). This type of representation, using 
connected, directed, acyclic graphs, is hown in the art of model checking. The use of OBDDs in 
this regard is described, for example, by McMillan in Symbolic Model Checking (Kluwer 
Academic Press, Norwell, Massachusetts, 1993), which is incorporated herein by r e f e r e nc e. 



